It occurred to me that DKIM verified emails, from major players (e.g., GMail), could open the door to more modern OpenPGP robot key signing authorities.

The idea would be to ask people to send a key singing request to a known address (e.g., [email protected]), and to sign their request with their OpenPGP key. The DKIM signature of that email would then be checked so as to verify that the requester has control over the claimed account (i.e., that GMail, for example, asserts that the email was sent by a valid / authenticated user). If everything checks out, the bot would sign the corresponding identity in the sender's public key, and send it back.

My understanding is that DKIM makes it much more difficult to spoof an email address when the "From: " header is included in the DKIM signature.

So, I ask the community here, what are some weaknesses or limitations of this approach? Here are some of the issues that I've considered:

• In the past, DKIM keys were much too short (< 1024 bit RSA). This has been resolved.
• DKIM public keys are hosted as DNS records, and plain-old DNS can be spoofed (perhaps pinning can be used for major players)
• DKIM keys are perhaps less protected than other security credentials, as their primary purpose is to combat spam and phising (no solution?).

Are there other dangers I'm overlooking?

NOTE: For what it's worth, it would appear that keybase.io is toying with this idea (https://github.com/keybase/keybase-issues/issues/373)